feat(db): techgarden_app role + techgarden database (backend consolidation P1)

kubernetes/clusters/1276-dev/databases/postgresql/app-externalsecrets.yaml

@@ -106,3 +106,34 @@ spec:
     - secretKey: password
       remoteRef:
         key: "7015df9c-04a0-4034-96e4-b485016ae080"
+---
+# Consolidated app-role password (ADR-0031). SAME Bitwarden entry feeds the
+# five product-namespace app secrets in the techgarden repo (password parity).
+# Reuses the former iris_app entry (promoted to techgarden_app under the
+# consolidation — nothing connects as iris_app after the cutover). PR2 CAUTION:
+# do NOT delete this Bitwarden entry when retiring the per-service roles; it now
+# backs techgarden_app. Mint a dedicated entry then if decoupling is wanted.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: techgarden-db-app-credentials
+  namespace: databases
+spec:
+  refreshInterval: 24h
+  secretStoreRef:
+    name: bitwarden-secretsmanager
+    kind: ClusterSecretStore
+  target:
+    name: techgarden-db-app-credentials
+    template:
+      type: kubernetes.io/basic-auth
+      metadata:
+        labels:
+          cnpg.io/reload: "true"
+      data:
+        username: techgarden_app
+        password: "{{ .password }}"
+  data:
+    - secretKey: password
+      remoteRef:
+        key: "6389718c-e6b6-4912-b4e1-b47e00553637"

kubernetes/clusters/1276-dev/databases/postgresql/cluster.yaml

@@ -104,3 +104,17 @@ spec:
         connectionLimit: -1
         passwordSecret:
           name: notifications-db-app-credentials
+      # Consolidated app role (ADR-0031). The five services connect as this one
+      # role against the `techgarden` DB (schema per module); the per-service
+      # roles above stay until PR2 so their DBs remain the rollback.
+      - name: techgarden_app
+        ensure: present
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        bypassrls: false
+        inherit: true
+        connectionLimit: -1
+        passwordSecret:
+          name: techgarden-db-app-credentials

kubernetes/clusters/1276-dev/databases/postgresql/databases.yaml

@@ -1,6 +1,7 @@
 ---
 # iris + dopamenu + plates + notifications databases on the shared `postgresql`
-# cluster (ADR-0018).
+# cluster (ADR-0018), plus the consolidated `techgarden` database (ADR-0031,
+# schema-per-module) — the per-service DBs stay as the PR1 rollback.
 # databaseReclaimPolicy: retain => deleting the CR never drops the live database.
 apiVersion: postgresql.cnpg.io/v1
 kind: Database
@@ -49,3 +50,18 @@ spec:
   cluster:
     name: postgresql
   databaseReclaimPolicy: retain
+---
+# Consolidated database (ADR-0030/0031). Adopts the existing `techgarden` DB
+# created by the cluster bootstrap (initdb), reassigning its owner from the
+# bootstrap `techgardencode` to the managed `techgarden_app` role.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: techgarden-database
+  namespace: databases
+spec:
+  name: techgarden
+  owner: techgarden_app
+  cluster:
+    name: postgresql
+  databaseReclaimPolicy: retain